WordPress vulnerability database
Every CVE published for WordPress core, plugins and themes since January 2024: 29,211 vulnerabilities, 1,526 of them in the last 30 days. The list is updated every day from the CVE List.
Severity is the CVSS 3.1 base score. Select a band to list only those. Last updated October 7, 2026.
Showing 151–200 of 246 vulnerabilities matching your filters
| Severity | Component | Vulnerability | Affected versions | Published | CVE | Source |
|---|---|---|---|---|---|---|
| 6.4 Medium | Gutenberg Page Builder Blocks & Ready-Made Patterns Library | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 3.2.4 |
CVE-2024-8325 |
Wordfence | |
| 6.5 Medium | Gutenverse | Cross-Site Scripting Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.9.4 - Cross Site Scripting (XSS) |
≤ 1.9.4 Fixed in 2.0.0 |
CVE-2024-43920 |
Patchstack | |
| 6.5 Medium | SKT Blocks – Gutenberg based Page Builder | Cross-Site Scripting |
≤ 1.5 |
CVE-2024-43946 |
Patchstack | |
| 6.5 Medium | WP Travel Gutenberg Blocks | Cross-Site Scripting |
≤ 3.5.1 Fixed in 3.6.0 |
CVE-2024-43284 |
Patchstack | |
| 6.5 Medium | Gutentor - Gutenberg Blocks - Page Builder for Gutenberg Editor | Cross-Site Scripting Gutenberg Blocks – Page Builder for Gutenberg Editor plugin <= 3.3.5 - Cross Site Scripting (XSS) |
≤ 3.3.5 Fixed in 3.3.6 |
CVE-2024-43308 |
Patchstack | |
| 6.5 Medium | Responsive Blocks – WordPress Gutenberg Blocks | Cross-Site Scripting WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) |
≤ 1.8.8 Fixed in 1.8.9 |
CVE-2024-43335 |
Patchstack | |
| 6.4 Medium | Gutenberg Blocks, Page Builder – ComboBlocks | Cross-Site Scripting ComboBlocks <= 2.2.87 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Block |
≤ 2.2.84 |
CVE-2024-7588 |
Wordfence | |
| 6.5 Medium | Spectra | Cross-Site Scripting |
≤ 2.14.1 Fixed in 2.15.1 |
CVE-2024-7590 |
Patchstack | |
| 6.5 Medium | BetterDocs | Cross-Site Scripting Best Documentation, FAQ & Knowledge Base Plugin with AI Support & Instant Answer for Elementor & Gutenberg plugin <= 3.5.8 - Cross Site Scripting (XSS) |
≤ 3.5.8 Fixed in 3.5.9 |
CVE-2024-43227 |
Patchstack | |
| 5.4 Medium | Gutenberg Blocks with AI by Kadence WP | Cross-Site Scripting Contributor+ Stored XSS |
< 3.2.39 Fixed in 3.2.39 |
CVE-2024-6884 |
WPScan | |
| 4.3 Medium | TemplateSpare – 1000+ WordPress Starter Templates & Full Site Migration Tool | 1-Click Import/Export & No-Code Builder | Broken Access Control TemplateSpare <= 2.4.2 - Missing Authorization to Authenticated (Subscriber+) Theme Update |
≤ 2.4.2 |
CVE-2024-6872 |
Wordfence | |
| 6.5 Medium | Ultimate Blocks – Gutenberg Blocks | Cross-Site Scripting WordPress Blocks Plugin plugin <= 3.1.9 - Cross Site Scripting (XSS) |
≤ 3.1.9 Fixed in 3.2.0 |
CVE-2024-37457 |
Patchstack | |
| 6.5 Medium | Gutenberg | Cross-Site Scripting |
≤ 18.6.0 Fixed in 18.6.1 |
CVE-2024-37492 |
Patchstack | |
| 6.5 Medium | Premium Blocks – Gutenberg Blocks | Cross-Site Scripting Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) |
≤ 2.1.27 Fixed in 2.1.28 |
CVE-2024-37519 |
Patchstack | |
| 6.5 Medium | Caxton – Create Pro page layouts in Gutenberg | Cross-Site Scripting Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) |
≤ 1.30.1 |
CVE-2024-37948 |
Patchstack | |
| 6.5 Medium | Magical Posts Display – Elementor & Gutenberg Posts Blocks | Cross-Site Scripting |
≤ 1.2.38 Fixed in 1.2.39 |
CVE-2024-37951 |
Patchstack | |
| 6.5 Medium | Post Layouts for Gutenberg | Cross-Site Scripting |
≤ 1.2.7 |
CVE-2024-38682 |
Patchstack | |
| 6.5 Medium | SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) | Cross-Site Scripting |
≤ 1.4.1 Fixed in 1.5.0 |
CVE-2024-38684 |
Patchstack | |
| 6.5 Medium | FancyPost – Best Ultimate Post Block, Post Grid, Layouts, Carousel, Slider For Gutenberg & Elementor | Cross-Site Scripting |
≤ 5.3.1 Fixed in 5.3.2 |
CVE-2024-38686 |
Patchstack | |
| 5.3 Medium | Getwid – Gutenberg Blocks | Broken Access Control Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update No login needed |
≤ 2.0.10 |
CVE-2024-6489 |
Wordfence | |
| 4.3 Medium | Getwid – Gutenberg Blocks | Broken Access Control Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update |
≤ 2.0.10 |
CVE-2024-6491 |
Wordfence | |
| 6.4 Medium | Gutenberg Blocks with AI by Kadence WP – Page Builder Features | Cross-Site Scripting Page Builder Features <= 3.2.45 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via HTML Data Attributes |
≤ 3.2.45 |
CVE-2024-5819 |
Wordfence | |
| 6.4 Medium | Stackable – Page Builder Gutenberg Blocks | Cross-Site Scripting Page Builder Gutenberg Blocks <= 3.13.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting |
≤ 3.13.1 |
CVE-2024-6296 |
Wordfence | |
| 6.4 Medium | Gutenberg Blocks with AI by Kadence WP – Page Builder Features | Cross-Site Scripting Page Builder Features <= 3.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting in Google Maps Widget |
≤ 3.2.42 |
CVE-2024-5289 |
Wordfence | |
| 6.5 Medium | WordPress Form Builder Plugin – Gutenberg Forms | Broken Access Control Auth. Broken Access Control |
≤ 2.2.8.3 Fixed in 2.2.9 |
CVE-2022-45803 |
Patchstack | |
| 5.4 Medium | Spectra | Broken Access Control |
≤ 2.6.6 Fixed in 2.6.7 |
CVE-2023-36676 |
Patchstack | |
| 6.4 Medium | Gutenberg Blocks by Kadence Blocks – Page Builder Features | Cross-Site Scripting Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleFont Parameter |
≤ 3.2.38 |
CVE-2024-4863 |
Wordfence | |
| 6.4 Medium | ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) | Cross-Site Scripting WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via WL Product Horizontal Filter Widget |
≤ 2.9.0 |
CVE-2024-5530 |
Wordfence | |
| 6.5 Medium | Essential Blocks for Gutenberg | Broken Access Control |
≤ 4.4.9 Fixed in 4.4.10 |
CVE-2024-30467 |
Patchstack | |
| 6.5 Medium | Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor | Cross-Site Scripting |
≤ 1.3.9 Fixed in 1.4.0 |
CVE-2024-35731 |
Patchstack | |
| 6.4 Medium | EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | Cross-Site Scripting Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widget |
≤ 4.0.1 |
CVE-2024-5571 |
Wordfence | |
| 4.3 Medium | Gutenberg Blocks and Page Layouts – Attire Blocks | Broken Access Control Attire Blocks <= 1.9.2 - Missing Authorization |
≤ 1.9.2 |
CVE-2024-4088 |
Wordfence | |
| 6.1 Medium | Gutenberg Blocks by Kadence Blocks | Cross-Site Scripting Contributor+ Stored XSS No login needed |
< 3.2.37 Fixed in 3.2.37 |
CVE-2024-4057 |
WPScan | |
| 5.3 Medium | Spectra | Content Injection WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email Spoofing No login needed |
≤ 2.3.0 Fixed in 2.3.1 |
CVE-2023-23738 |
Patchstack | |
| 5.3 Medium | Spectra | Content Injection WordPress Gutenberg Blocks plugin <= 2.3.0 - Unauthenticated Email HTML Injection No login needed |
≤ 2.3.0 Fixed in 2.3.1 |
CVE-2023-23735 |
Patchstack | |
| 5.3 Medium | Spectra | Authentication Bypass WordPress Gutenberg Blocks plugin <= 2.3.0 - Captcha Bypass No login needed |
≤ 2.3.0 Fixed in 2.3.1 |
CVE-2023-23730 |
Patchstack | |
| 6.5 Medium | Elegant Blocks | Cross-Site Scripting Amazing Gutenberg Blocks plugin <= 1.7 - Cross Site Scripting (XSS) |
≤ 1.7 |
CVE-2024-34769 |
Patchstack | |
| 6.4 Medium | Page Builder Gutenberg Blocks – CoBlocks | Cross-Site Scripting CoBlocks <= 3.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Profiles |
≤ 3.1.9 |
CVE-2024-2933 |
Wordfence | |
| 6.4 Medium | Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX | Cross-Site Scripting PostX <= 4.1.1 - Authenticated (Author+) Stored Cross-Site Scripting |
≤ 4.1.1 |
CVE-2024-5223 |
Wordfence | |
| 6.4 Medium | Spectra – WordPress Gutenberg Blocks | Cross-Site Scripting WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting |
≤ 2.13.0 |
CVE-2024-4366 |
Wordfence | |
| 4.3 Medium | EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more | Broken Access Control Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Insufficient Authorization Checks to Block Usual |
≤ 3.9.12 |
CVE-2024-1803 |
Wordfence | |
| 6.4 Medium | Spectra – WordPress Gutenberg Blocks | Cross-Site Scripting WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Block |
≤ 2.12.8 |
CVE-2024-1814 |
Wordfence | |
| 6.4 Medium | Spectra – WordPress Gutenberg Blocks | Cross-Site Scripting WordPress Gutenberg Blocks <= 2.12.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Gallery Block |
≤ 2.12.8 |
CVE-2024-1815 |
Wordfence | |
| 6.4 Medium | Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates | Cross-Site Scripting Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 4.5.12 |
CVE-2024-4891 |
Wordfence | |
| 6.4 Medium | Gutenberg Blocks by Kadence Blocks – Page Builder Features | Cross-Site Scripting Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typer Effect |
≤ 3.2.37 |
CVE-2024-4208 |
Wordfence | |
| 5.4 Medium | Gutenberg Blocks by Kadence Blocks – Page Builder Features | Cross-Site Scripting Page Builder Features <= 3.2.37 - Authenticated (Contributor+) Stored Cross-Site Scripting |
≤ 3.2.37 |
CVE-2024-3189 |
Wordfence | |
| 6.4 Medium | Borderless - Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg | Cross-Site Scripting Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets |
≤ 1.5.3 |
CVE-2024-4666 |
Wordfence | |
| 6.4 Medium | Gutenberg Blocks by Kadence Blocks – Page Builder Features | Cross-Site Scripting Page Builder Features <= 3.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Timer |
≤ 3.2.36 |
CVE-2024-4209 |
Wordfence | |
| 6.4 Medium | Gutenberg Blocks with AI by Kadence WP | Cross-Site Scripting Authenticated (Contributor+) Stored Cross-Site Scripting via Block Link |
≤ 3.2.36 |
CVE-2024-4481 |
Wordfence | |
| 6.4 Medium | Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) | Cross-Site Scripting Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via pagingType Parameter |
≤ 3.7.1 |
CVE-2024-4446 |
Wordfence |
About this data
- Where it comes from
- Each row is a record from the CVE List, published by the organization that handled the report: most often Wordfence, Patchstack or WPScan. The CVE ID links to that publisher's advisory.
- What is included
- CVEs published since January 1, 2024 for WordPress core, plugins and themes, premium ones included. Vulnerabilities that never received a CVE ID are not listed, and rejected CVEs are removed.
- Severity
- The CVSS 3.1 base score set by the publisher, or by CISA when the publisher gave none. "No login needed" means the score assumes an attacker without an account.
- Affected versions
- The range the publisher marked as vulnerable. When the record also names the first fixed release, it is shown under the range. If your version is newer than every affected one, that CVE does not apply to you.
- Updates
- Every day, after the CVE List publishes its end-of-day changes.
CVE® records are © The MITRE Corporation and used under the CVE Terms of Use. CVE is a registered trademark of The MITRE Corporation.